py-django: updated to 6.1.3
Django 6.1.3 fixes five security issues with severity “low”, one security issue
with severity “moderate”, and several bugs in 6.1.2. It also adds compatibility
with Python 3.15.
p5-CGI: update to 5.02.
5.02 2026-11-03
[ RELEASE NOTES ]
- this is a security release fixing a large number of vulnerabilities,
several of them exploitable by any client against any script. all
users should upgrade
- to fix them some default behaviour has changed, see BREAKING CHANGES
below - most changes only affect malicious or malformed requests, but
please read them before upgrading. where a change could reasonably
affect a legitimate application an opt out or migration path is given
- the minimum *supported* perl version is now 5.10, however the dist
will still install for 5.8 (no guarantees about tests passing however)
[ SECURITY ]
- denial of service:
- CVE-2026-120631: CGI::Cookie->parse (and so CGI->cookie) used a
client supplied cookie expires value as a regex, so a Cookie header
[123 lines not shown]
py-dns: updated to 2.9.2
2.9.2
A maliciously crafted zone file could use a WKS record to consume excessive
memory and CPU, possibly causing the process to exit due to memory exhaustion.
adguardhome: updated to 0.107.80
0.107.80
Security
Go version has been updated to mitigate the possibility of exploiting the Go vulnerabilities fixed in 1.27.3.
Support for Multipath TCP has been disabled to mitigate the possibility of exploiting the vulnerability described in CVE-2026-98432.
security/pkcs11-provider: Wire up tests to softhsm and nss softokn.
Otherwise they don't really test anything! Need at least one PKCS#11
library to test this with. softhsm and softokn from nss are the two
ones supported by the pkcs11-provider tests that I found in pkgsrc;
another, kryoptic, is not currently packaged (and pulls in Rust), so
I left it out for now.
With this, I get:
> Ok: 55
> Fail: 0
> Skipped: 71
py-msgpack: update to 1.2.4 (security)
Also allow this version in py-borgbackup, following upstream.
1.2.3
- Fix memory leaks in the C extension when map key validation or
container hooks fail. See GHSA-j586-36cw-2gc2.
- wheels: also build for pyodide using emscripten
- Support packing Python 3.15 frozentdict (PEP 814)
- Reject negative array and map header sizes
1.2.4
- fallback: pass object_pairs_hook a list of pairs
- fallback: leave the object unread when a header type does not match
- fallback: return bytes from Unpacker.read_bytes
- dependency updates
